Is CVE-2026-93366 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93366 being exploited in the wild.

How severe is CVE-2026-93366?

Medium severity, with a CVSS score of 5.4, published 25 September 2026.

Which products and versions are affected?

Bludit CMS through 3.22.0, also affecting 4.0.0-beta-1.

Is there a fix for CVE-2026-93366?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93366 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93366?

Check whether you run Bludit CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93366: Bludit CMS authorization bypass in media file deletion

CVE-2026-93366 · Severity: medium · CVSS 5.4 · Published 2026-09-25

Bludit CMS, a content management system used to publish website pages and media files, contains a flaw that allows low-privileged author accounts to delete and enumerate media files that belong to other users, including administrators. An attacker with an author account can use this vulnerability to destroy media assets across the entire site, causing service disruption and data loss.

Technologies: Bludit CMS. Vendors: Bludit.

Quick answers

Is CVE-2026-93366 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93366 being exploited in the wild.
How severe is CVE-2026-93366?: Medium severity, with a CVSS score of 5.4, published 25 September 2026.
Which products and versions are affected?: Bludit CMS through 3.22.0, also affecting 4.0.0-beta-1.
Is there a fix for CVE-2026-93366?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93366 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93366?: Check whether you run Bludit CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in AJAX endpoints (list-images and delete-image) within bl-kernel/ajax/ that fail to properly validate whether an authenticated user owns the page whose media files they are accessing. An authenticated Author can enumerate all page UUIDs via content-get-list and then craft POST requests with arbitrary uuid parameters to read and delete media files outside their authorization scope, bypassing the IMAGE_RESTRICT isolation control.

Affected products

Bludit Bludit CMS through 3.22.0, also affecting 4.0.0-beta-1

Timeline

2026-09-25: disclosed: Vulnerability details published by researcher Akıner Kısa
2026-09-24: other: Re-tested against upstream master commit 074773eff34b91c002ab9d99029a3edca4934bf1; remains reproducible

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.